CVE-2026-59899 Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-59899?
CVE-2026-59899 is a medium-severity vulnerability in Netty Netty, published on 29 Jul 2026.
Official description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Weakness: CWE-770
Which versions are affected by CVE-2026-59899?
4 open source packages ship an affected version, including io.netty:netty-codec-http. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty-codec-http Maven | All versions | 4.1.136.Final |
io.netty:netty-codec-http Maven | All versions | 4.1.136.Final |
io.netty:netty-codec-http Maven | From 4.2.0.Final | 4.2.16.Final |
io.netty:netty-codec-http Maven | From 4.2.0.Final | 4.2.16.Final |
Products include Netty Netty.
How do I fix CVE-2026-59899?
Upgrade io.netty:netty-codec-http to a fixed version for your release line: 4.1.136.Final or 4.2.16.Final.
Is CVE-2026-59899 being exploited?
There is no known exploitation of CVE-2026-59899 in the wild and no public exploit code.
Other vulnerabilities in Netty Netty
- CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
- CVE-2026-75596 Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
- CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
- CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
- CVE-2026-56745 Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
Sources
Also known as CLEANSTART-2026-BX32842, CLEANSTART-2026-DM42176, CLEANSTART-2026-EA53751, CLEANSTART-2026-LJ83599, CLEANSTART-2026-UQ38105, DEBIAN-CVE-2026-59899 and 108 more.